![]() Mysqli_query($dbcon,"update userlogin set surname='$fname', othernames='$oname' where staffid='$staffid'")or die(mysqli_error()) ![]() `status` is vulnerable both to boolean-based blind and time-based blind SQLi `username` is only vulnerable to time-based blind SQLi `oname` is vulnerable both to boolean-based blind and time-based blind SQLi `fname` is vulnerable both to boolean-based blind and time-based blind SQLi # Testeted on: Linux (Ubuntu 20.04) using LAMPPĪn authenticated user may be able to read data for which is not authorized, tamper with or destroy data, or possibly even read/write files or execute code on the database server.Īll four parameters passed via POST are vulnerable: # Exploit Author: Davide 't0rt3ll1n0' Taraschi # Exploit Title: Crime records Management System 1.0 - 'Multiple' SQL Injection (Authenticated)
0 Comments
Leave a Reply. |